Resources · /kits/hipaa-sra
HIPAA security self-check
A quick, private self-assessment. Your answers never leave this browser.
Answers stay in this browserNo analytics on this page~8 minutes
Access & accounts
Every staff member has their own login (no shared passwords)
Multi-factor authentication is on for email and remote access
Former staff accounts are removed the same day
Backups
Backups run daily and are kept offsite
At least one backup copy cannot be changed or deleted
A restore was tested in the last 6 months
Email & devices
Phishing filtering is enabled on practice email
Computers have current updates and endpoint protection
Laptops and phones with practice data are encrypted
Vendors & BAAs
You keep a list of every vendor that touches patient data
Each of those vendors has a signed BAA on file
You know who to call if a vendor reports a breach